SELinux

wikipedia:Security-Enhanced Linux is a Linux kernel security module that provides a mechanism for supporting access control security policies, including mandatory access controls (MAC).

semanage and restorecon command line utilities can be used to manage SELinux configuration and behavior.

SELinux is available in RHEL 4 since 2005 and in Ubuntu. As of 2018 Ubuntu 18.04 LTS do not install SELinux by default.

Command-line utilities

chcon,restorecon,restorecond,runcon,secon,fixfiles,setfiles,load_policy,booleans,getsebool,setsebool,toggleseboolsetenforce, semodule, postfix-nochroot, check-selinux-installation, semodule_package, checkmodule, selinux-config-enforcing,selinuxenabled, and selinux-policy-upgrade

sestatus
setenforce enforcing

See also

• AppArmor, /etc/apparmor.d/libvirt, apparmor_status
• Seccomp
• SELinux, semanage, sestatus, getenforce, chcon, security context, setsebool
• Mandatory access control: AppArmor, SELinux, seccomp, System Integrity Protection (macOS)

"SELinux/Commands - FedoraProject". Retrieved 2015-11-25.

"chcon". Linuxcommand.org. Archived from the original on 2004-10-24. Retrieved 2013-02-06.

"restorecon(8) - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"restorecond(8) - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"runcon(1) - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"secon(1) - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"fixfiles(8): fix file SELinux security contexts - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"setfiles(8): set file SELinux security contexts - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"load_policy(8) - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"booleans(8) - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"getsebool(8): SELinux boolean value - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"setsebool(8): set SELinux boolean value - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"togglesebool(8) - Linux man page". Linux.die.net. Retrieved 2013-02-06.

"Ubuntu Manpage: selinux-config-enforcing - change /etc/selinux/config to set enforcing". Canonical Ltd. Archived from the original on 2012-12-20. Retrieved 2013-02-06.

"Ubuntu Manpage: selinuxenabled - tool to be used within shell scripts to determine if". Canonical Ltd. Archived from the original on 2013-02-09. Retrieved 2013-02-06.

"Ubuntu Manpage: selinux-policy-upgrade - upgrade the modules in the SE Linux policy". Canonical Ltd. Archived from the original on 2012-04-04. Retrieved 2013-02-06.